Hong Kong Seizes Devices If Travelers Refuse Passwords

HONG KONG — On March 23, 2026, Hong Kong implemented sweeping changes to its National Security Law enforcement mechanisms that fundamentally alter the risk calculus for anyone passing through the territory. The new regulations criminalize refusing to provide passwords or decryption assistance for personal electronic devices to Hong Kong police. This isn't a policy targeting specific individuals under investigation. It applies universally to everyone in Hong Kong, including U.S. citizens simply transiting through Hong Kong International Airport.

The U.S. Consulate General in Hong Kong and Macau issued a security alert confirming the legal change and its broad application. Under the amended implementing rules, authorities can demand access to cellphones, laptops, and any other personal electronic devices. Refusal is now a criminal offense. There are no exemptions for transit passengers who never leave the airport, business travelers on short layovers, or foreign nationals asserting privacy protections under their home country's laws.

What This Means for Travelers

The practical implications are stark. If you're traveling through Hong Kong, you must now assume Hong Kong police have legal authority to demand full access to the contents of your devices. This includes messaging apps, email, photos, cloud storage accounts, work documents, encrypted files, and any other data stored on or accessible through your phone or laptop.

Hong Kong authorities can compel you to unlock biometric protections, provide alphanumeric passwords, or assist in decrypting secured content. The regulation explicitly covers "decryption assistance," meaning if you use password managers, two-factor authentication apps, or encrypted storage solutions, you can be required to provide the necessary credentials or steps to access that material.

The expanded rules also grant Hong Kong authorities greater latitude to confiscate and retain devices as evidence if they claim the devices are linked to national security offenses. The standard for what constitutes a "link" to national security has remained deliberately vague under Hong Kong's National Security Law framework, leaving significant discretion to enforcement officials.

No Safe Harbor for Transit Passengers

One of the most significant aspects of this regulation is its application to passengers in transit. Hong Kong International Airport has long functioned as a major regional hub, with millions of passengers annually connecting through the territory en route to other destinations across Asia, Australia, and beyond. Many travelers spend only a few hours in Hong Kong's airport without clearing immigration into the city itself.

Under the new rules, transit status offers no protection. If Hong Kong police decide to question you or inspect your devices while you're in the airport, you are subject to the same legal requirements as someone entering Hong Kong or residing there. Refusal carries criminal penalties, not administrative fines or travel delays.

How This Differs From Other Jurisdictions

Border searches of electronic devices are not unique to Hong Kong. U.S. Customs and Border Protection, for example, can conduct warrantless searches of devices at ports of entry, though legal challenges and evolving court rulings have created some limitations. Other countries maintain similar authority.

The Hong Kong regulation differs in scope and enforcement framework. It explicitly criminalizes refusal, rather than treating it as grounds for denial of entry or administrative detention. It applies under national security provisions that carry significantly harsher penalties than customs or immigration violations. And it operates within a legal system where due process protections and judicial independence have eroded substantially since the imposition of the National Security Law in 2020.

Assessing the Risk

For most leisure travelers, the probability of being stopped and subjected to device inspection remains statistically low. Hong Kong processes enormous passenger volumes daily, and authorities lack the resources to examine every traveler's devices.

However, certain traveler profiles face elevated risk. Journalists covering Hong Kong, mainland China, or regional political developments should assume heightened scrutiny. Photographers carrying work depicting protests, political movements, or sensitive subjects may attract attention. Activists, researchers focused on human rights or governance issues, and individuals with professional or personal ties to dissident communities are at higher risk.

Business travelers face more ambiguous exposure. Corporate executives, technology professionals, and anyone carrying proprietary business information on devices now face a legal environment where Hong Kong authorities can compel access to that material. Whether this constitutes acceptable risk depends on the sensitivity of the data, the traveler's industry, and corporate security policies.

Practical Mitigation Strategies

The most effective risk mitigation is route avoidance. Travelers concerned about device security should route around Hong Kong entirely. Alternative hubs include Tokyo, Seoul, Singapore, Taipei, and Bangkok. Flight availability and pricing may vary, but avoiding Hong Kong eliminates exposure to this regulation.

For travelers who must transit Hong Kong, consider traveling with minimal or sanitized devices. Use a device that contains no sensitive data, stripped of work email, cloud storage access, messaging apps with sensitive conversations, or photos that could be misinterpreted. This approach has limitations; it doesn't protect against demands to provide credentials to cloud accounts, and it may not prevent suspicion if authorities notice the device is unusually empty.

Some professionals choose to mail devices ahead or use freight services to bypass carrying devices through Hong Kong personally. This introduces logistical complexity and doesn't eliminate all risk, but it removes the immediate exposure of a device search during transit.

Encrypting devices offers no legal protection under the new regulation, since authorities can criminalize refusal to decrypt. Encryption remains a security measure against theft or loss, but it does not shield against government-compelled access in Hong Kong.

What to Do If Detained

The U.S. Consulate General advises travelers to contact them immediately if arrested or detained. The consulate maintains a 24-hour emergency line at +852 2523-9011 for after-hours assistance, with regular business hours available at +852 2841-2211. Consular officers can provide a list of local attorneys, notify family members, and monitor conditions of detention, though they cannot interfere in Hong Kong's legal processes or secure release.

Travelers should enroll in the State Department's Smart Traveler Enrollment Program before departure. STEP allows the U.S. government to contact you in an emergency and ensures you receive security updates for Hong Kong and other destinations.

A Shifting Landscape

This regulatory change reflects Hong Kong's continued integration into mainland China's security and legal frameworks. Since the imposition of the National Security Law in 2020, Hong Kong has steadily expanded the definition and enforcement of national security offenses, reduced judicial independence, and curtailed civil liberties that once distinguished the territory from the mainland.

For travelers, the calculus has shifted. Hong Kong is no longer simply a convenient transit point with familiar infrastructure and international connectivity. It's now a jurisdiction where device privacy does not exist as a practical matter, where refusal to comply with device searches is criminal, and where the legal system offers limited recourse for travelers caught in enforcement actions.

Anyone planning travel through Hong Kong should assess their risk profile, consider alternative routing, and travel with eyes open about what this new regulation actually means.